Data retention policy
Customer data is retained while the customer remains active. Upon subscription termination, all customer data is purged from UserEvidence systems within 30 days.
Additionally, backup and recovery procedures ensure that data is stored securely and tested regularly to ensure availability. Logs are preserved in accordance with regulatory requirements.
Data archiving and removal policy
UserEvidence follows a data archival and removal policy designed to ensure compliance with security and privacy best practices:
Data Archival
UserEvidence does not explicitly archive customer data beyond active use.
Customer data remains in production systems while the customer is active.
Backups are maintained and tested regularly to ensure data availability.
Data Removal
When a customer subscription is terminated, all customer data is purged from UserEvidence systems within 30 days.
Sensitive data and logs are deleted following secure disposal methods to prevent unauthorized recovery.
Before disposal of physical or digital media, data is either securely erased or destroyed according to industry best practices.
Backup & Recovery Management
Full and incremental backups are taken at regular intervals and stored securely.
Backups are not retained indefinitely and are purged according to business and compliance needs.
Access to backups is strictly controlled, and they are encrypted at rest and in transit.
Users can request data removal by emailing support@userevidence.com.
Data storage policy
UserEvidence's Data Storage Policy ensures secure handling, storage, and protection of customer and company data. Below are the key aspects of the policy:
1. Data Storage Locations
All data is stored on Amazon Web Services (AWS) infrastructure, located in the USA, which is SOC 2 accredited and ISO 27001 certified.
Primary storage includes AWS S3 for file storage and Heroku Postgres for transactional database storage.
2. Data Encryption
At Rest: Data is encrypted using AES-128 GCM encryption.
In Transit: All data transmission is secured using TLS/SSL cryptographic protocols.
3. Data Access Controls
Access to stored data follows the principle of least privilege (PoLP).
Role-Based Access Control (RBAC) is enforced, with access reviews conducted quarterly.
Multi-Factor Authentication (MFA) is required for privileged access.
4. Data Retention & Deletion
Data is retained while the customer remains active.
When a customer subscription ends, data is purged within 30 days.
Backup data is retained for operational and compliance needs, but it is not stored indefinitely.
5. Backup & Disaster Recovery
Full and incremental backups are taken regularly and stored securely.
Backups are tested regularly for integrity and recoverability.
The Business Continuity Plan (BCP) includes disaster recovery strategies to maintain availability.
Data center location(s)
United States
Data hosting details
Cloud hosted via Heroku / AWS
App/service has sub-processors
no
App/service uses large language models (LLM)
no